2

The working of BPDU filter configured globally is described as follows:

If that port receives a BPDU it loses its Portfast status and transitions through the normal Blocking, Learning, Listening, and Forwarding state, as necessary

What is the purpose of the global BPDU filter? Why doesn't it work the same way as BPDU filter configured on a port?

4

What is the purpose of the global BPDU filter?

Portfast is a feature that should only be implemented on ports that do not receive BPDUs (or need to send them). In other words, it should only be implemented on edge ports. So if you receive BPDUs on such a port, how do you want to handle it?

  1. Do nothing - Simply ignore the BPDUs and continue operating as configured.
  2. Err on the side of caution - Disable the port.
  3. Something in between - Switch out of portfast mode and allow STP to run over the link normally.

Two features give you the ability to respond in any of the three above ways, BPDU filter and BPDU guard.

If you want to do nothing, simply apply BPDU filter at the interface level. The only time I have ever seen this used wisely is when you are handing off to a customer (and have taken other precautions to avoid issues).

Since end users generally should not be allowed to connect their own switches to the network, most places today seem to go with option two, utilizing BPDU guard coupled with err-disable recovery. This will shut down the port automatically if a device sending BPDUs (or one that will loop BPDUs back to the interface) is connected to the network. Interfaces will automatically be re-enabled after a set time and will stay re-enabled if the condition were removed.

Global configuration of BPDU filter is the middle of the road and allows you to apply the command automatically to any port where you have enabled portfast. If BPDUs are detected it will drop the portfast mode. This would allow you to plug in another switch device without losing access or risking a L2 loop. I can't think of many reasons today to use this, although in the past when BPDU guard didn't have an err-disable recovery option (i.e. re-enabling ports was a manual process) it could be a better choice than BPDU guard, protecting the network while not increasing load on IT staff.

Additionally, the interface versions of BPDU filter/guard both supersede the global configuration. In other words, you can use the interface command to disable a globally enabled feature on a portfast enabled interface. Additionally, while the global version only apply to interfaces with portfast enabled, you can enable either on an interface that does not have portfast enabled.

Why doesn't it work the same way as BPDU filter configured on a port?

Because it wasn't designed that way. It was designed to provide additional configuration options to tailor the operation to the needs of your network.

For example, you could have a situation where you wanted a portfast enabled port but did not want to send or receive BPDUs. If both global and interface commands worked the same, you would have issues trying to configure it this way if both acted the same as the global configuration. Conversely, if you wanted the "middle of the road" above but both acted like the interface command, you would have issues.

2

The different behavior of the two commands is because they serve a different purpose. Both having the same name is confusing though. They could have named the global command something like "edge protect". Portfast ports are spanning-tree edge ports, so only meant to be connected to systems that don't run spanning tree.

  • The global BPDU filter command is there to detect when a port has been incorrectly configured as an edge port and make it participate in spanning tree.
  • BPDU filter on the port is meant to connect two different spanning tree domains that shouldn't talk with each other. You have to be absolutely sure there will be no layer 2 loops. That is why you cannot set this globally.

The different purpose is also the reason the two work differently in sending BPDUs: configured on the port will send no BPDUs, configured on globally, it will send for ten hello timers (=11 BPDUs, one at the beginning, plus one every hello timer).

  • Global BPDU filter is seems to security violation right? – Trojan Mar 21 '16 at 11:23
  • After 10 hello timers what happen? – Trojan Mar 21 '16 at 11:24
  • Yes, BPDU filter is a way to respond to a policy violation. When you recieve BPDUs on an edge port, you should react in one of two ways: Join the port into spanning tree (global BPDU filter) or shut the port down (BPDU guard). After 10 hello timers, the global filter will stop sending BPDUs but still listen for them. – JelmerS Mar 21 '16 at 13:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.